How are users associated to service principals?

Question

Hello,
I am trying to implement Kerberos authentication on a Windows machine and have trouble understanding how users are mapped to service principals.
I understand that the ktpass or Setspn tools are used to associate a service principal to an Active Directory account because a service that is being secured by Kerberos needs to be mapped to an Active Directory account(e.g. account X). So, when executing a command from either one that account X only is mapped to the service principal.
Now, say user user1 having account Y tries to access the service corresponding to the above service principal.
My question is how does Kerberos know that account Y is allowed to access the secured application? How can I associate account Y with the above principal?
Thank you,
Savvas.

Answer 1

savvas.andreas wrote:
right..I think I see what you mean. So, it is true then that any user who has logged on to his/her windows account can access any application on the domain they've logged on to because they are authenticated against that domain?Yes, that is correct if no further action is taken.
One thing that still confuses me though is why does that second phase in Kerberos authentication needs to be applied? What I mean is that from what I was able to read, at a very generic level, Kerberos employs a two-phase process:In the first phase the client authenticates itself through the "Authentication Service" of the "Key Distribution Centre" and receives back a Ticket Granting Ticket (TGT). But then, in the second phase the same client requests a "Service Ticket" from the "Ticket Granting Service" of the "Key Distribution Centre" by presenting the TGT acquired earlier. If any authenticated user is allowed to access any resource why is that second phase (specific to the service for which access is requested) necessary? wouldn't just the first authentication phase suffice?
I appreciate your solution and it's something we also considered initially but we were hoping Kerberos would provide this process for us :)No it wouldn't. After the first phase the client is only known to the KDC. No service is aware of any client. With the creation of a specific service ticket the service knows that the user is seriously trustworthy. Kerberos is based on a shared secret which means only the KDC knows that the client and user are real. The KDC acts as a trusted 3rd party. That's why all import authn goes thru it. Read this artice for further clarification: [http://simple.wikipedia.org/wiki/Kerberos_%28protocol%29]